Vulnerability database

41,225 results · page 396 of 825

• Mar 24, 2025CopyLink: Cross-Site Request Forgery (CSRF)CVE-2025-30603 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in DEJAN CopyLink copy-link allows Stored XSS.This issue affects CopyLink: from n/a through <= 1.1.

  Product

  CopyLink

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update CopyLink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Related Posts via Categories: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30602 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alphasis Related Posts via Categories related-posts-via-categories allows Stored XSS.This issue affects Related Posts via Categories: from n/a through <= 2.1.2.

  Product

  Related Posts via Categories

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Related Posts via Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Flipdish Ordering System: Cross-Site Request Forgery (CSRF)CVE-2025-30601 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in flipdish Flipdish Ordering System flipdish-ordering-system allows Cross Site Request Forgery.This issue affects Flipdish Ordering System: from n/a through <= 1.5.2.

  Product

  Flipdish Ordering System

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update Flipdish Ordering System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Hotjar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30600 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thiagogsrwp WP Hotjar wp-hotjar allows Stored XSS.This issue affects WP Hotjar: from n/a through <= 0.0.3.

  Product

  WP Hotjar

  Affected

  up to 0.0.3

  What to do

  Affects up to 0.0.3. Update WP Hotjar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Parallax Content Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30599 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp-maverick WP Parallax Content Slider wp-parallax-content-slider allows Stored XSS.This issue affects WP Parallax Content Slider: from n/a through <= 0.9.8.

  Product

  WP Parallax Content Slider

  Affected

  up to 0.9.8

  What to do

  Affects up to 0.9.8. Update WP Parallax Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025OSS Upload: Cross-Site Request Forgery (CSRF)CVE-2025-30598 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Link OSS Upload oss-upload allows Cross Site Request Forgery.This issue affects OSS Upload: from n/a through <= 4.8.9.

  Product

  OSS Upload

  Affected

  up to 4.8.9

  What to do

  Affects up to 4.8.9. Update OSS Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025IG Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30597 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iografica IG Shortcodes ig-shortcodes allows DOM-Based XSS.This issue affects IG Shortcodes: from n/a through <= 3.1.

  Product

  IG Shortcodes

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update IG Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025include-file: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30595 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tstafford include-file include-file allows Stored XSS.This issue affects include-file: from n/a through <= 1.

  Product

  include-file

  Affected

  up to 1

  What to do

  Affects up to 1. Update include-file to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Include URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30593 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk Include URL include-url allows Stored XSS.This issue affects Include URL: from n/a through <= 0.3.5.

  Product

  Include URL

  Affected

  up to 0.3.5

  What to do

  Affects up to 0.3.5. Update Include URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Advanced Dewplayer: Missing AuthorizationCVE-2025-30592 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WesternDeal Advanced Dewplayer advanced-dewplayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Dewplayer: from n/a through <= 1.6.

  Product

  Advanced Dewplayer

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Advanced Dewplayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Music Press Pro: Missing AuthorizationCVE-2025-30591 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in tuyennv Music Press Pro music-press-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Press Pro: from n/a through <= 1.4.6.

  Product

  Music Press Pro

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update Music Press Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Flickr set slideshows: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30590 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows SQL Injection.This issue affects Flickr set slideshows: from n/a through <= 0.9.

  Product

  Flickr set slideshows

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Flickr set slideshows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Map Contact: Cross-Site Request Forgery (CSRF)CVE-2025-30588 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ryan_xantoo Map Contact map-contact allows Stored XSS.This issue affects Map Contact: from n/a through <= 3.0.4.

  Product

  Map Contact

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update Map Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025LH OGP Meta: Cross-Site Request Forgery (CSRF)CVE-2025-30587 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in shawfactor LH OGP Meta lh-ogp-meta-tags allows Stored XSS.This issue affects LH OGP Meta: from n/a through <= 1.73.

  Product

  LH OGP Meta

  Affected

  up to 1.73

  What to do

  Affects up to 1.73. Update LH OGP Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025cTabs: Cross-Site Request Forgery (CSRF)CVE-2025-30586 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bbodine1 cTabs ctabs allows Stored XSS.This issue affects cTabs: from n/a through <= 1.3.

  Product

  cTabs

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update cTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Generate Post Thumbnails: Cross-Site Request Forgery (CSRF)CVE-2025-30585 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in marynixie Generate Post Thumbnails generate-post-thumbnails allows Cross Site Request Forgery.This issue affects Generate Post Thumbnails: from n/a through <= 0.8.

  Product

  Generate Post Thumbnails

  Affected

  up to 0.8

  What to do

  Affects up to 0.8. Update Generate Post Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025AlphaOmega Captcha & Anti-Spam Filter: Cross-Site Request Forgery (CSRF)CVE-2025-30584 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter alphaomega-captcha-anti-spam allows Stored XSS.This issue affects AlphaOmega Captcha & Anti-Spam Filter: from n/a through <= 3.3.

  Product

  AlphaOmega Captcha & Anti-Spam Filter

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update AlphaOmega Captcha & Anti-Spam Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Pro Rank Tracker: Cross-Site Request Forgery (CSRF)CVE-2025-30583 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ProRankTracker Pro Rank Tracker proranktracker allows Stored XSS.This issue affects Pro Rank Tracker: from n/a through <= 1.0.0.

  Product

  Pro Rank Tracker

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Pro Rank Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Top Bar: Missing AuthorizationCVE-2025-30581 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in PluginOps Top Bar ultimate-bar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Top Bar: from n/a through <= 3.3.

  Product

  Top Bar

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update Top Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025AdSense Privacy Policy: Cross-Site Request Forgery (CSRF)CVE-2025-30578 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hotvanrod AdSense Privacy Policy adsense-privacy-policy allows Stored XSS.This issue affects AdSense Privacy Policy: from n/a through <= 1.1.1.

  Product

  AdSense Privacy Policy

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update AdSense Privacy Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Browser Address Bar Color: Cross-Site Request Forgery (CSRF)CVE-2025-30577 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mendibass Browser Address Bar Color browser-address-bar-color allows Stored XSS.This issue affects Browser Address Bar Color: from n/a through <= 3.3.

  Product

  Browser Address Bar Color

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update Browser Address Bar Color to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Hacklog Remote Image Autosave: Cross-Site Request Forgery (CSRF)CVE-2025-30576 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Image Autosave hacklog-remote-image-autosave allows Cross Site Request Forgery.This issue affects Hacklog Remote Image Autosave: from n/a through <= 2.1.0.

  Product

  Hacklog Remote Image Autosave

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Hacklog Remote Image Autosave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Login Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30575 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Login Redirect login-redirect allows Stored XSS.This issue affects Login Redirect: from n/a through <= 1.0.5.

  Product

  Login Redirect

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Mobile Navigation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30574 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jenst Mobile Navigation mobile-navigation allows Stored XSS.This issue affects Mobile Navigation: from n/a through <= 1.5.

  Product

  Mobile Navigation

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Mobile Navigation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025My Default Post Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30573 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny My Default Post Content my-default-post-content allows Stored XSS.This issue affects My Default Post Content: from n/a through <= 0.7.3.

  Product

  My Default Post Content

  Affected

  up to 0.7.3

  What to do

  Affects up to 0.7.3. Update My Default Post Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Simple Rating: Cross-Site Request Forgery (CSRF)CVE-2025-30572 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Igor Yavych Simple Rating simple-rating allows Stored XSS.This issue affects Simple Rating: from n/a through <= 1.4.

  Product

  Simple Rating

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Simple Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025STEdb Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30571 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in STEdb Corp. STEdb Forms stedb-forms allows SQL Injection.This issue affects STEdb Forms: from n/a through <= 1.0.4.

  Product

  STEdb Forms

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update STEdb Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025دکمه، شبکه اجتماعی خرید: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30570 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AliRezaMohammadi دکمه، شبکه اجتماعی خرید dokme allows SQL Injection.This issue affects دکمه، شبکه اجتماعی خرید: from n/a through <= 2.0.6.

  Product

  دکمه، شبکه اجتماعی خرید

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update دکمه، شبکه اجتماعی خرید to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Featured Entries: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30569 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jahertor WP Featured Entries wp-featured-entries allows SQL Injection.This issue affects WP Featured Entries: from n/a through <= 1.0.

  Product

  WP Featured Entries

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Featured Entries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Super Static Cache: Cross-Site Request Forgery (CSRF)CVE-2025-30568 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in hitoy Super Static Cache super-static-cache allows Cross Site Request Forgery.This issue affects Super Static Cache: from n/a through <= 3.3.5.

  Product

  Super Static Cache

  Affected

  up to 3.3.5

  What to do

  Affects up to 3.3.5. Update Super Static Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Clink: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30566 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aryan Themes Clink clink allows DOM-Based XSS.This issue affects Clink: from n/a through <= 1.2.2.

  Product

  Clink

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Clink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025banner-manager: Cross-Site Request Forgery (CSRF)CVE-2025-30565 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in karrikas banner-manager banner-manager allows Stored XSS.This issue affects banner-manager: from n/a through <= 16.04.19.

  Product

  banner-manager

  Affected

  up to 16.04.19

  What to do

  Affects up to 16.04.19. Update banner-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Custom Script Integration: Cross-Site Request Forgery (CSRF)CVE-2025-30564 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wpwox Custom Script Integration custom-script-integration allows Stored XSS.This issue affects Custom Script Integration: from n/a through <= 2.1.

  Product

  Custom Script Integration

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Custom Script Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025CAS Maestro: Cross-Site Request Forgery (CSRF)CVE-2025-30561 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Henrique Mouta CAS Maestro cas-maestro allows Stored XSS.This issue affects CAS Maestro: from n/a through <= 1.1.3.

  Product

  CAS Maestro

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update CAS Maestro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025jQuery Dropdown Menu: Cross-Site Request Forgery (CSRF)CVE-2025-30560 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu jquery-drop-down-menu-plugin allows Stored XSS.This issue affects jQuery Dropdown Menu: from n/a through <= 3.0.

  Product

  jQuery Dropdown Menu

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update jQuery Dropdown Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025ANAC XML Render: Cross-Site Request Forgery (CSRF)CVE-2025-30558 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in EnzoCostantini55 ANAC XML Render anac-xml-render allows Stored XSS.This issue affects ANAC XML Render: from n/a through <= 1.5.7.

  Product

  ANAC XML Render

  Affected

  up to 1.5.7

  What to do

  Affects up to 1.5.7. Update ANAC XML Render to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Easy 301 Redirects: Cross-Site Request Forgery (CSRF)CVE-2025-30557 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in odihost Easy 301 Redirects odihost-easy-redirect-301 allows Cross Site Request Forgery.This issue affects Easy 301 Redirects: from n/a through <= 1.33.

  Product

  Easy 301 Redirects

  Affected

  up to 1.33

  What to do

  Affects up to 1.33. Update Easy 301 Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Fix Rss Feeds: Cross-Site Request Forgery (CSRF)CVE-2025-30556 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in flyaga Fix Rss Feeds fix-rss-feed allows Cross Site Request Forgery.This issue affects Fix Rss Feeds: from n/a through <= 3.1.

  Product

  Fix Rss Feeds

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update Fix Rss Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WordPres 同步微博: Cross-Site Request Forgery (CSRF)CVE-2025-30555 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in iiiryan WordPres 同步微博 wp2wb allows Stored XSS.This issue affects WordPres 同步微博: from n/a through <= 1.1.0.

  Product

  WordPres 同步微博

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update WordPres 同步微博 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025GMO Font Agent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30553 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Z.com byGMO GMO Font Agent gmo-font-agent allows Stored XSS.This issue affects GMO Font Agent: from n/a through <= 1.6.

  Product

  GMO Font Agent

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update GMO Font Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WordPress Admin Bar Improved: Cross-Site Request Forgery (CSRF)CVE-2025-30552 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Donald Gilbert WordPress Admin Bar Improved wordpress-admin-bar-improved allows Stored XSS.This issue affects WordPress Admin Bar Improved: from n/a through <= 3.3.5.

  Product

  WordPress Admin Bar Improved

  Affected

  up to 3.3.5

  What to do

  Affects up to 3.3.5. Update WordPress Admin Bar Improved to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Pretty file links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30551 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartredfox Pretty file links pretty-file-links allows Stored XSS.This issue affects Pretty file links: from n/a through <= 0.9.

  Product

  Pretty file links

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Pretty file links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025CallPhone'r: Cross-Site Request Forgery (CSRF)CVE-2025-30550 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in WPShop.ru CallPhone'r callphoner allows Stored XSS.This issue affects CallPhone'r: from n/a through <= 1.1.1.

  Product

  CallPhone'r

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update CallPhone'r to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Yummly Rich Recipes: Cross-Site Request Forgery (CSRF)CVE-2025-30549 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Yummly Yummly Rich Recipes yummly-rich-recipes allows Cross Site Request Forgery.This issue affects Yummly Rich Recipes: from n/a through <= 4.2.

  Product

  Yummly Rich Recipes

  Affected

  up to 4.2

  What to do

  Affects up to 4.2. Update Yummly Rich Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Cackle: Cross-Site Request Forgery (CSRF)CVE-2025-30546 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in boroV Cackle cackle allows Cross Site Request Forgery.This issue affects Cackle: from n/a through <= 4.33.

  Product

  Cackle

  Affected

  up to 4.33

  What to do

  Affects up to 4.33. Update Cackle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025issuuPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30545 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline issuuPress issuupress allows Stored XSS.This issue affects issuuPress: from n/a through <= 1.3.2.

  Product

  issuuPress

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update issuuPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Menu Duplicator: Missing AuthorizationCVE-2025-30543 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in swayam.tejwani Menu Duplicator copy-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Menu Duplicator: from n/a through <= 1.0.

  Product

  Menu Duplicator

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Menu Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025SoundCloud Ultimate: Cross-Site Request Forgery (CSRF)CVE-2025-30542 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in wpsolutions SoundCloud Ultimate soundcloud-ultimate allows Cross Site Request Forgery.This issue affects SoundCloud Ultimate: from n/a through <= 1.5.

  Product

  SoundCloud Ultimate

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update SoundCloud Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Info Boxes Shortcode and Widget: Cross-Site Request Forgery (CSRF)CVE-2025-30541 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Info Boxes Shortcode and Widget info-boxes-shortcode-and-widget allows Cross Site Request Forgery.This issue affects Info Boxes Shortcode and Widget: from n/a through <= 1.15.

  Product

  Info Boxes Shortcode and Widget

  Affected

  up to 1.15

  What to do

  Affects up to 1.15. Update Info Boxes Shortcode and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025AvaiBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30540 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in avaibook AvaiBook avaibook allows Stored XSS.This issue affects AvaiBook: from n/a through <= 1.2.

  Product

  AvaiBook

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update AvaiBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.